With just a few months remaining before the California Consumer Privacy Act comes into effect, companies throughout the Golden State and beyond are scrambling to figure out how to comply with some of the CCPA’s more confusing and demanding requirements. However, another subset of companies are facing a different question: does the law even apply to us?

The question arises because the CCPA draws an important distinction between “service providers” and “third parties.” A service provider, a company that provides analysis or processing services to another company, must agree by contract to uphold certain protections of the CCPA but is left free of the most arduous requirements of the CCPA, such as fielding user requests for disclosure of data. What companies want to avoid are situations where they believe they are signing up to be service providers but unintentionally put themselves in a position to comply with the entire CCPA.

A new decision out of the Ninth Circuit Court of Appeals could be a bellwether for future privacy cases under the California Consumer Privacy Act. On Thursday, the Ninth Circuit held that the plaintiffs in a class-action lawsuit against Facebook alleging violation of an Illinois biometrics law had standing, allowing the case to move forward.

Given the similarities between the Illinois law and the relevant portions of the CCPA, the Ninth Circuit’s decision may dramatically expand standing in future cases under the CCPA for similar biometric violations.

Welcome to 2019, where almost every product, service, and website tracks every bit of data it can about us and creates a giant profile it can use to make inferences and predict our every move and desire. Even if a company doesn’t sell our data, so many companies in our society today rely on the mass aggregation of data to inform their marketing decisions.

These systems can be pretty frighteningly precise. We’ve all heard about the time Target figured out that a high school girl was pregnant and began marketing maternity items to her before her parents knew, creating some…awkward discussions at home. As a white man of Jewish heritage in his 30s, who likes the San Francisco Giants and Shawshank Redemption, maybe I’m more likely to buy a Toyota that gets at least 40 MPG or less likely to drink spiced rum. Somebody out there probably knows.

One of the most interesting but unpredictable parts of the California Consumer Privacy Act is the portion of the law that requires companies to share not just the information collected about consumers, but also the inferences they’ve made based on this data. This requirement could potentially implicate companies’ marketing strategy or even trade secrets.